fix: stop double HTML-escaping course name in enrollment emails

[Waleed-Mujahid]

Problem

Course titles containing & (or <, >, ") render as CICT&L in instructor enrollment/beta emails. Reported on Koa for a course named "Cambridge International Certificate in Teaching & Learning CICT&L 5881 Unit One (Pilot)".

Root cause — two escapes stacked

1. Python: get_email_params / send_mail_to_student wrapped course_name in Text() (= markupsafe.escape) → & becomes &.
2. Template: in the edx-ace HTML bodies, {% blocktrans %} runs under autoescape-on and was wrapped in {% filter force_escape %} → escapes a second time → & → renders &.

The subject and body.txt use {% autoescape off %}, so removing Text() alone fixed those; the HTML body needed the template change too.

Fix

• Drop the Text() wrapper on course_name (both call sites) — templates own the escaping.
• In the 7 instructor body.html templates, switch course_name blocktrans blocks from {% filter force_escape %} to {% autoescape off %} + xss-lint disable.

Backport of upstream openedx/edx-platform#31995 ("fix subject email and body html code"), which fixed this on master but was never backported to the Koa release line. Cherry-pick isn't viable — that commit sits on 2023 master and conflicts across the whole repo on Koa.

Coverage / notes

• All 7 instructor email types: allowed/enrolled enroll+unenroll, add/remove beta tester, account-creation-and-enrollment.
• Converts one block fix: fix subject email and body html code openedx/openedx-platform#31995 missed: account-creation "Sincerely yours, The {course_name} Team".
• Leaves as upstream: the addbetatester {% blocktrans asvar course_cta_text %}Visit {{ course_name }}{% endblocktrans %} block — different render path (feeds the CTA include); upstream left it untouched.

Testing

Not run locally — Koa devstack not up in this environment. Relies on CI. No behavior change beyond escaping of course_name in these emails.